{"action":"created","issue":{"url":"https://api.github.com/repos/crystal-lang/crystal/issues/5266","repository_url":"https://api.github.com/repos/crystal-lang/crystal","labels_url":"https://api.github.com/repos/crystal-lang/crystal/issues/5266/labels{/name}","comments_url":"https://api.github.com/repos/crystal-lang/crystal/issues/5266/comments","events_url":"https://api.github.com/repos/crystal-lang/crystal/issues/5266/events","html_url":"https://github.com/crystal-lang/crystal/issues/5266","id":272570001,"number":5266,"title":"Issues verifying certificate connecting with HTTPS","user":{"login":"theodorton","id":874365,"avatar_url":"https://avatars0.githubusercontent.com/u/874365?v=4","gravatar_id":"","url":"https://api.github.com/users/theodorton","html_url":"https://github.com/theodorton","followers_url":"https://api.github.com/users/theodorton/followers","following_url":"https://api.github.com/users/theodorton/following{/other_user}","gists_url":"https://api.github.com/users/theodorton/gists{/gist_id}","starred_url":"https://api.github.com/users/theodorton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theodorton/subscriptions","organizations_url":"https://api.github.com/users/theodorton/orgs","repos_url":"https://api.github.com/users/theodorton/repos","events_url":"https://api.github.com/users/theodorton/events{/privacy}","received_events_url":"https://api.github.com/users/theodorton/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-11-09T13:48:25Z","updated_at":"2017-11-14T09:15:33Z","closed_at":null,"author_association":"NONE","body":"### Crystal version\r\n\r\n```\r\n~/code/nabobil/autotoll · (master±)\r\n⟩ crystal -v\r\nCrystal 0.23.1 (2017-10-12) LLVM 4.0.1\r\n```\r\n\r\n### How to reproduce\r\n\r\n```crystal\r\n# test.cr\r\nrequire \"http/client\"\r\n\r\nclient = HTTP::Client.new(\"maps.googleapis.com\", tls: true)\r\nclient.get \"/\"\r\n```\r\n\r\nThen run `crystal run test.cr`.\r\n\r\n### Expected outcome\r\n\r\nNo errors raised, or some redirect.\r\n\r\n### Actual outcome\r\n\r\n```\r\nSSL_connect: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (OpenSSL::SSL::Error)\r\n0x10d990e45: *CallStack::unwind:Array(Pointer(Void)) at ??\r\n0x10d990de1: *CallStack#initialize:Array(Pointer(Void)) at ??\r\n0x10d990db8: *CallStack::new:CallStack at ??\r\n0x10d98d615: *raise<OpenSSL::SSL::Error>:NoReturn at ??\r\n0x10da33571: *OpenSSL::SSL::Socket::Client#initialize<TCPSocket, OpenSSL::SSL::Context::Client, Bool, String>:Nil at ??\r\n0x10da333ec: *OpenSSL::SSL::Socket::Client::new:context:sync_close:hostname<TCPSocket, OpenSSL::SSL::Context::Client, Bool, String>:OpenSSL::SSL::Socket::Client at ??\r\n0x10da29c91: *HTTP::Client#socket:(OpenSSL::SSL::Socket+ | TCPSocket+) at ??\r\n0x10da299eb: *HTTP::Client#exec_internal_single<HTTP::Request>:(HTTP::Client::Response | Nil) at ??\r\n0x10da26f7c: *HTTP::Client#exec_internal<HTTP::Request>:HTTP::Client::Response at ??\r\n0x10da26e72: *HTTP::Client#exec<HTTP::Request>:HTTP::Client::Response at ??\r\n0x10da26bdd: *HTTP::Client#exec<String, String, Nil, Nil>:HTTP::Client::Response at ??\r\n0x10da26bb7: *HTTP::Client#get<String>:HTTP::Client::Response at ??\r\n0x10d97bcba: __crystal_main at ??\r\n0x10d98c678: main at ??\r\n```\r\n\r\n### Notes\r\n\r\n- This also happens when running the code within the official docker image for `0.23.1`.\r\n- I've managed to get it to pass randomly, but I believe there is some cipher requirement and that the certificates differ somewhat between the servers behind this domain\r\n- When running `openssl s_client -connect maps.googleapis.com:443 -tls1_2` I get:\r\n\r\n```\r\nCONNECTED(00000003)\r\ndepth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA\r\nverify return:1\r\ndepth=1 C = US, O = Google Inc, CN = Google Internet Authority G2\r\nverify return:1\r\ndepth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = *.googleapis.com\r\nverify return:1\r\n---\r\n...\r\n...\r\n```\r\n\r\n- It works if I setup a similar example in Ruby:\r\n\r\n```ruby\r\nrequire 'net/http'\r\nrequire 'uri'\r\n\r\nuri = URI('https://maps.googleapis.com/')\r\n\r\nNet::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|\r\n  request = Net::HTTP::Get.new uri\r\n  response = http.request request # Net::HTTPResponse object\r\n  puts response\r\nend\r\n```\r\n\r\n- In other words, I don't believe this is an issue with my `openssl` configuration."},"comment":{"url":"https://api.github.com/repos/crystal-lang/crystal/issues/comments/344193164","html_url":"https://github.com/crystal-lang/crystal/issues/5266#issuecomment-344193164","issue_url":"https://api.github.com/repos/crystal-lang/crystal/issues/5266","id":344193164,"user":{"login":"theodorton","id":874365,"avatar_url":"https://avatars0.githubusercontent.com/u/874365?v=4","gravatar_id":"","url":"https://api.github.com/users/theodorton","html_url":"https://github.com/theodorton","followers_url":"https://api.github.com/users/theodorton/followers","following_url":"https://api.github.com/users/theodorton/following{/other_user}","gists_url":"https://api.github.com/users/theodorton/gists{/gist_id}","starred_url":"https://api.github.com/users/theodorton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theodorton/subscriptions","organizations_url":"https://api.github.com/users/theodorton/orgs","repos_url":"https://api.github.com/users/theodorton/repos","events_url":"https://api.github.com/users/theodorton/events{/privacy}","received_events_url":"https://api.github.com/users/theodorton/received_events","type":"User","site_admin":false},"created_at":"2017-11-14T09:15:33Z","updated_at":"2017-11-14T09:15:33Z","author_association":"NONE","body":"@ysbaddaden Yes, we're ok with `Client.insecure` for now, but it doesn't seem to verify certificates. I think that should probably be noted in the documentation. Currently the docs say:\r\n\r\n> Use this only if undoing the defaults that new sets is too much hassle.\r\n\r\nNot sure if I can spend more time at the moment looking into the defaults. I'm not very fluent in TLS terminology so I'd just have to guess what the different options represent. The failures were pretty consistent with that hostname, even when I ran it in the Docker image for `0.23.1`.\r\n\r\nI still think this is highly relevant:\r\n\r\n> I'm still getting undefined constant OpenSSL::OPENSSL_102 errors when attempting to use X509VerifyFlags.\r\n\r\nAs I believe using the `OpenSSL::SSL::X509VerifyFlags:: TRUSTED_FIRST` might work."}}
{"actor":{"display_login":"theodorton"}}